REMARKS 

Claims 1-104 were pending in the application. Claims 1-104 have been cancelled. 
Claims 105-128 have been added. Therefore, claims 105-128 are pending in the application. 

DOUBLE PATENTING REJECTION 

Regarding the provisional obviousness-type double patenting rejection, in view of 
the cancellation of claims 1-104, Applicant respectfully submits that this rejection is 
now moot. 

REJECTIONS UNDER 35 U.S.C. §102 

The Examiner has rejected claims 1-5, 13, 21-33, 41, 49-61, 69, 77-87, and 95- 
97 under 35 U.S.C. §102(e) as being anticipated by Muttik, I., U.S. Patent No. 
6,770,780. Claims 6-12, 14-20, 34-40, 42-48, 62-68, 70-76, 88-94, and 98-104 under 
35 U.S.C. § 103(a) as being unpatentable over Muttik and Chess et al., U.S. Patent No. 
6,772,346. In view of the cancellation of claims 1-104, Applicant respectfully 
submits that these rejections are now moot. 

Regarding claim 105, Applicant respectfully submits that Muttik does not 
teach or suggest the feature of "wherein at least some of the code associated with the 
selected active program is running in kernel mode " (emphasis added). In contrast, 
Muttik teaches that: 

Emulator 110 includes emulator buffer 201, emulator code 203, 
comparison unit 204, database 206 and rules 210. Emulator buffer 201 
is a protected region of memory (also known as a sandbox) in which 
code 108 is stored and emulated. Emulator code 203 includes code to 
perform the emulation. Emulator buffer 201 and emulator code 203 are 
designed so that code 108 that is executing within emulator buffer 201 
cannot damage or compromise computer system 106. 

See Muttik, col. 3, lines 54-65 (emphasis added). 

Applicant respectfully submits that since "code 108 that is executing within 
emulator buffer 201 cannot damage or compromise computer system 106," it cannot 
include "code" that "is running in kernel mode," as is recited in claim 105. 
Furthermore, Applicant submits that it would not be obvious to modify Muttik such 
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that "at least some of the code associated with the active program program is running in 
kernel mode" since doing so would render Muttik inoperable for its intended purpose, 
preventing "damage or compromise" to "computer system 106." 

Regarding claim 115, Applicant respectfully submits that Muttik does not 
teach or suggest the feature of "selecting a program currently running on a computer 
system as code under investigation, wherein said program is running in a manner that 
permits infection of said computer system." As described above, code running within 
Muttik' s "emulator" is in an environment that "cannot damage or compromise 
computer system 106." See Muttik, col. 3, lines 64-65. Applicant thus respectfully 
submits that nowhere does Muttik teach or suggest "selecting a program ... wherein 
said program is running in a manner that permits infection of said computer system," 
as recited in claim 115. It would not be obvious to modify Muttik in the manner 
recited in claim 115 for reasons similar to those stated above for claim 105. 

Claims 127 and 127 recite features similar to claim 115 and are believed 
allowable for reasons similar to those presented above for claim 115. 

Thus claims 105, 115, 127 and 128, along with their respective dependent 
claims, are believed to patentably distinguish. 
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CONCLUSION: 



Applicants submit the application is in condition for allowance, and an early 
notice to that effect is requested. 



The Commissioner is authorized to charge any fees that may be required, or credit 
any overpayment, to Meyertons, Hood, Kivlin, Kowert & Goetzel, P.C. Deposit Account 
No. 501505/6002-00602/DMM. 



Respectfully submitted, 



Date: December 6. 2006 

Dean M. Munyon 
Reg. No. 42,914 




Meyertons, Hood, Kivlin, Kowert & Goetzel, P.C. 
P. O. Box 398 
Austin, Texas 78767 
(512) 853-8847 
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